Perl is a widely deployed dynamic programming language and scripting platform embedded across system administration, web application, and data processing workflows, presenting a moderate but highly prevalent vulnerability surface. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a moderate tendency toward public exploit availability, reflecting the memory-safety demands and parsing complexity inherent to the interpreter and its extension ecosystem. The exposure concentrates in the core Perl interpreter and its database-interaction modules such as DBI, recurs through memory-safety weakness classes including out-of-bounds writes, buffer overflows, and improper input validation, and carries particular weight because flaws in the interpreter can propagate across the vast installed base of Perl-dependent legacy systems and infrastructure. Defenders should treat Perl interpreter updates as a priority for systems running untrusted input processing or exposed CGI applications; live exploitation and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Perl over time
Signals from CVEs in this vendor scope (76 CVEs).
76 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-6329HIGH The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compi | Jan 4, 2013 | 7.5 | 77 | NO | YES |
CVE-2026-14739CRITICAL DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.
The fix for CVE-2026-10879 did not allocate enough m | Jul 7, 2026 | 9.8 | 42 | NO | NO |
CVE-2026-13221CRITICAL Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_stud | Jul 13, 2026 | 9.1 | 41 | NO | NO |
CVE-2026-9698CRITICAL DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.
Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a | Jun 9, 2026 | 9.8 | 41 | NO | NO |
CVE-2026-14740CRITICAL DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment.
The preparse method normalises SQL and removes comments. When the | Jul 7, 2026 | 9.1 | 40 | NO | NO |
CVE-2026-14380HIGH DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.
When a string is assigned to a DBI handle's Profile attribute, DBI splits it int | Jul 7, 2026 | 8.8 | 40 | NO | NO |
CVE-2026-8376CRITICAL Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.
Perl_study_chunk in regcomp_study.c che | May 25, 2026 | 9.8 | 40 | NO | NO |
CVE-2026-10879CRITICAL DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.
The preparse method expands SQL placeholder characters to numbered | Jun 5, 2026 | 9.8 | 39 | NO | NO |
CVE-2018-18312CRITICAL Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. | Dec 5, 2018 | 9.8 | 38 | NO | NO |
CVE-2026-57432HIGH Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.
S_measure_struct adds each item's size times i | Jul 13, 2026 | 8.4 | 37 | NO | NO |
Signals from CVEs in this vendor scope (76 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Perl.
Media articles that mention a CVE ID that affects a product developed by Perl — matched by CVE ID, not by vendor name.